<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
    pageEncoding="ISO-8859-1"%>
<%@page import="java.sql.*" %>
<%@page import="com.sectooladdict.database.ConnectionPoolManager" %>
<%@ page import="com.sectooladdict.validators.InputValidator" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Case 18 - Injection into numeric values in a calculation page with erroneous responses and quote validation</title>
</head>
<body>

<%
if (request.getParameter("minBalanace") == null) {
%>
	Count Accounts With Balance Equal or Higher to:<br><br>
	<form name="frmInput" id="frmInput" action="Case18-InjectionInCalc-NumericWithoutQuotes-BooleanExploit-WithErrors.jsp" method="POST">
		<input type="text" name="minBalanace" id="minBalanace" value="10000"><br>
		<input type=submit value="submit">
	</form>
<%
} 
else {
	Connection conn = null;
    try {
  	    String minBalanace = request.getParameter("minBalanace");

  	    if (InputValidator.validateQuotes(minBalanace)) {
  	    	out.println("Invalid Input");
  	    }
  	    else {
  	    	conn = ConnectionPoolManager.getConnection();
     
        	System.out.print("Connection Opened Successfully\n");

 	    	String SqlString = 
	            "SELECT COUNT(*)" +
 	        	"FROM accounts " +
 	        	"WHERE account >= " + minBalanace;
 			Statement stmt = conn.createStatement();
 			ResultSet rs = stmt.executeQuery(SqlString);
 		 
 			if(rs.next()) {
	 			if (rs.getInt(1) > 0) {
 					out.println("Several accounts match the criteria.");
 				} else {
	 				out.println("No Match.");
 				}
 	    	} else {
	 	 		out.println("Unspecified error.");
 	 		}
  	    }
  	    
	  	out.flush();
	  	
	  	if(conn != null) {
        	ConnectionPoolManager.closeConnection(conn);
        }
	  	
    } catch (Exception e) {
        response.sendError(500,"Exception details: " + e);
        
        if(!(e instanceof com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException)) {
  	        System.out.println("Exception details: " + e);
        } 

		if(conn != null) {
        	ConnectionPoolManager.closeConnection(conn);
        }
    }
} //end of if/else block
%>

</body>
</html>